Impact
T1490 — Inhibit System Recovery
Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features...
Investigate Inhibit System Recovery activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.
Platforms
Containers, ESXi, IaaS, Linux, macOS, Network Devices, Windows
Priority / status
high / complete
Evidence to collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts
D3-SU · harden
Software Update
Apply Software Update to reduce this technique's viability before an incident occurs.
Tooling: Defender for Endpoint
D3-RS · restore
Restore Software
Use Restore Software to recover affected systems or data after containment.
Tooling: Defender for Endpoint
D3-SWI · model
Software Inventory
Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot.
Tooling: Defender for Endpoint
| ATT&CK Technique | D3FEND Technique | Practical SOC Action | Tooling |
|---|---|---|---|
| T1490 Inhibit System Recovery | Software Update | Apply Software Update to reduce this technique's viability before an incident occurs. | Defender for Endpoint |
| T1490 Inhibit System Recovery | Restore Software | Use Restore Software to recover affected systems or data after containment. | Defender for Endpoint |
| T1490 Inhibit System Recovery | Software Inventory | Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot. | Defender for Endpoint |
T1490 Inhibit System Recovery → D3FEND → SOC action
Investigation steps — Microsoft
- Isolate the device immediately — do not wait for confirmation
- Alert the entire SOC team — this is an all-hands event
- Notify the SOC Manager by phone — who notifies the customer CISO
- Activate IR-RANSOMWARE-01 playbook in the SOAR platform
- Record the time of first alert — this is the start of the incident timeline
- 1 device: Isolated incident — still treat as active ransomware
- 2–5 devices: Active spread — consider emergency network segmentation at the switch level
- 5+ devices: Outbreak — activate BCP immediately, contact customer operations team
Investigation steps — generic
- Confirm whether the observed inhibit system recovery activity matches expected administrative or application behaviour.
- Identify the host, account, or resource where the activity occurred and its business criticality.
- Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.
- Real detection reference: "Recovery Controls Disabled Without Encryption" -- Standalone high-signal recovery sabotage rule. IM-002 covers ransomware encryption plus recovery inhibition; this rule catches the earlier stage where backups, shadow copies, or recovery controls are disabled before encryption.
Response actions
| Action | Risk | Automation safe | Approval required |
|---|---|---|---|
| Isolate ALL affected hosts | Medium | No | Yes |
| Disconnect NAS and network shares | Low | No | Yes |
| Notify: | Low | Yes | No |
| Activate BCP | Low | No | Yes |
| Do NOT reboot | Low | No | Yes |
| Do NOT pay the ransom | Low | No | Yes |
| Confirm backup integrity — are backups clean and accessible? | Low | Yes | No |
| Identify patient zero and begin root cause analysis | Low | No | Yes |
KQL
GEN-IM-004 — Recovery Controls Disabled Without Encryption
let lookback = 1h;
let recoveryInhibitCommands = dynamic([
"vssadmin delete shadows",
"vssadmin.exe delete shadows",
"wmic shadowcopy delete",
"wbadmin delete catalog",
"wbadmin delete systemstatebackup",
"get-wmiobject win32_shadowcopy",
"get-ciminstance win32_shadowcopy",
"bcdedit /set",
"recoveryenabled no",
"bootstatuspolicy ignoreallfailures",
"schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
"reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
"disablesr"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| extend CommandLine = tolower(tostring(ProcessCommandLine))
| where CommandLine has_any (recoveryInhibitCommands)
| summarize
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
CommandCount = dcount(CommandLine),
CommandSamples = make_set(ProcessCommandLine, 20),
Accounts = make_set(AccountName, 10),
ParentProcesses = make_set(InitiatingProcessFileName, 10)
by DeviceId, DeviceName
| project TimeGenerated = LastSeen, FirstSeen, LastSeen, DeviceId, DeviceName, CommandCount, CommandSamples, Accounts, ParentProcesses
| extend timestamp = TimeGenerated,
HostCustomEntity = DeviceName
| order by TimeGenerated descGEN-IM-002 — Data Encrypted for Impact - Ransomware
let detectionWindow = 1d;
let minEncryptedFiles = 20;
let suspiciousExtensions = dynamic([
"lockbit", "locked", "crypt", "crypto", "enc", "encrypted", "ryuk", "conti", "hive", "clop", "blackcat", "akira"
]);
let recoveryInhibitCommands = dynamic([
"vssadmin delete shadows",
"vssadmin.exe delete shadows",
"wmic shadowcopy delete",
"wbadmin delete catalog",
"wbadmin delete systemstatebackup",
"get-wmiobject win32_shadowcopy",
"get-ciminstance win32_shadowcopy",
"bcdedit /set",
"recoveryenabled no",
"bootstatuspolicy ignoreallfailures",
"schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
"reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
"disablesr",
"wevtutil cl",
"fsutil usn deletejournal",
"cipher /w"
]);
let RansomPrepCommands =
DeviceProcessEvents
| where TimeGenerated >= ago(detectionWindow)
| extend CommandLine = tolower(tostring(ProcessCommandLine))
| where CommandLine has_any (recoveryInhibitCommands)
| summarize
RansomPrepCommandCount = dcount(CommandLine),
RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),
PrepFirstSeen = min(TimeGenerated),
PrepLastSeen = max(TimeGenerated),
PrepAccounts = make_set(AccountName, 10)
by DeviceId, DeviceName;
let MassEncryptionBehavior =
DeviceFileEvents
| where TimeGenerated >= ago(detectionWindow)
| where ActionType in~ ("FileCreated", "FileRenamed", "FileModified")
| extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
| where FileExtension in (suspiciousExtensions)
| summarize
EncryptedFileCount = count(),
SampleEncryptedFiles = make_set(FileName, 20),
AffectedPaths = make_set(FolderPath, 20),
EncryptionFirstSeen = min(TimeGenerated),
EncryptionLastSeen = max(TimeGenerated),
AccountsSeen = make_set(InitiatingProcessAccountName, 10)
by DeviceId, DeviceName
| where EncryptedFileCount >= minEncryptedFiles;
MassEncryptionBehavior
| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName
| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,
HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0
| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)
| where ConfidenceScore >= 2
| project
TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),
DeviceId,
DeviceName,
HasMassEncryption,
EncryptedFileCount,
SampleEncryptedFiles,
AffectedPaths,
AccountsSeen,
HasRansomPrep,
RansomPrepCommandCount,
RansomPrepCommandSamples,
PrepAccounts,
EncryptionFirstSeen,
EncryptionLastSeen,
PrepFirstSeen,
PrepLastSeen,
ConfidenceScore
| extend timestamp = TimeGenerated,
HostCustomEntity = DeviceName
| order by ConfidenceScore desc, TimeGenerated desc8d2b6f4c-1a37-4e9b-b5c8-7f0e3a2d9c14 — Gambit Security - Critical Policy Issue Promotion
GambitPoliciesIssues
| where State == "Active" and Severity == "High"Escalation criteria
- Inhibit System Recovery activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.
False positive considerations
- Authorised backup software cleaning up old shadow copies — Backup agent process is signed, runs on a predictable schedule
- IT admin manual disk cleanup including shadows — Admin ran the command manually, confirmed via Live Response session
# T1490 - Inhibit System Recovery
## SOC Recommendation
Investigate Inhibit System Recovery activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.
## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Software Update | Harden | Apply Software Update to reduce this technique's viability before an incident occurs. |
| Restore Software | Restore | Use Restore Software to recover affected systems or data after containment. |
| Software Inventory | Model | Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot. |
## Investigation Steps
1. Isolate the device immediately — do not wait for confirmation
2. Alert the entire SOC team — this is an all-hands event
3. Notify the SOC Manager by phone — who notifies the customer CISO
4. Activate IR-RANSOMWARE-01 playbook in the SOAR platform
5. Record the time of first alert — this is the start of the incident timeline
6. 1 device: Isolated incident — still treat as active ransomware
7. 2–5 devices: Active spread — consider emergency network segmentation at the switch level
8. 5+ devices: Outbreak — activate BCP immediately, contact customer operations team
## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts
## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Isolate ALL affected hosts | Medium | No | Yes |
| Disconnect NAS and network shares | Low | No | Yes |
| Notify: | Low | Yes | No |
| Activate BCP | Low | No | Yes |
| Do NOT reboot | Low | No | Yes |
| Do NOT pay the ransom | Low | No | Yes |
| Confirm backup integrity — are backups clean and accessible? | Low | Yes | No |
| Identify patient zero and begin root cause analysis | Low | No | Yes |
## KQL
```kql
let lookback = 1h;
let recoveryInhibitCommands = dynamic([
"vssadmin delete shadows",
"vssadmin.exe delete shadows",
"wmic shadowcopy delete",
"wbadmin delete catalog",
"wbadmin delete systemstatebackup",
"get-wmiobject win32_shadowcopy",
"get-ciminstance win32_shadowcopy",
"bcdedit /set",
"recoveryenabled no",
"bootstatuspolicy ignoreallfailures",
"schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
"reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
"disablesr"
]);
DeviceProcessEvents
| where TimeGenerated >= ago(lookback)
| extend CommandLine = tolower(tostring(ProcessCommandLine))
| where CommandLine has_any (recoveryInhibitCommands)
| summarize
FirstSeen = min(TimeGenerated),
LastSeen = max(TimeGenerated),
CommandCount = dcount(CommandLine),
CommandSamples = make_set(ProcessCommandLine, 20),
Accounts = make_set(AccountName, 10),
ParentProcesses = make_set(InitiatingProcessFileName, 10)
by DeviceId, DeviceName
| project TimeGenerated = LastSeen, FirstSeen, LastSeen, DeviceId, DeviceName, CommandCount, CommandSamples, Accounts, ParentProcesses
| extend timestamp = TimeGenerated,
HostCustomEntity = DeviceName
| order by TimeGenerated desc
```
```kql
let detectionWindow = 1d;
let minEncryptedFiles = 20;
let suspiciousExtensions = dynamic([
"lockbit", "locked", "crypt", "crypto", "enc", "encrypted", "ryuk", "conti", "hive", "clop", "blackcat", "akira"
]);
let recoveryInhibitCommands = dynamic([
"vssadmin delete shadows",
"vssadmin.exe delete shadows",
"wmic shadowcopy delete",
"wbadmin delete catalog",
"wbadmin delete systemstatebackup",
"get-wmiobject win32_shadowcopy",
"get-ciminstance win32_shadowcopy",
"bcdedit /set",
"recoveryenabled no",
"bootstatuspolicy ignoreallfailures",
"schtasks.exe /change /tn \"\\microsoft\\windows\\systemrestore\\sr\" /disable",
"reg add \"hklm\\software\\policies\\microsoft\\windows nt\\systemrestore\"",
"disablesr",
"wevtutil cl",
"fsutil usn deletejournal",
"cipher /w"
]);
let RansomPrepCommands =
DeviceProcessEvents
| where TimeGenerated >= ago(detectionWindow)
| extend CommandLine = tolower(tostring(ProcessCommandLine))
| where CommandLine has_any (recoveryInhibitCommands)
| summarize
RansomPrepCommandCount = dcount(CommandLine),
RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),
PrepFirstSeen = min(TimeGenerated),
PrepLastSeen = max(TimeGenerated),
PrepAccounts = make_set(AccountName, 10)
by DeviceId, DeviceName;
let MassEncryptionBehavior =
DeviceFileEvents
| where TimeGenerated >= ago(detectionWindow)
| where ActionType in~ ("FileCreated", "FileRenamed", "FileModified")
| extend FileExtension = tolower(tostring(split(FileName, ".")[-1]))
| where FileExtension in (suspiciousExtensions)
| summarize
EncryptedFileCount = count(),
SampleEncryptedFiles = make_set(FileName, 20),
AffectedPaths = make_set(FolderPath, 20),
EncryptionFirstSeen = min(TimeGenerated),
EncryptionLastSeen = max(TimeGenerated),
AccountsSeen = make_set(InitiatingProcessAccountName, 10)
by DeviceId, DeviceName
| where EncryptedFileCount >= minEncryptedFiles;
MassEncryptionBehavior
| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName
| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,
HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0
| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)
| where ConfidenceScore >= 2
| project
TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),
DeviceId,
DeviceName,
HasMassEncryption,
EncryptedFileCount,
SampleEncryptedFiles,
AffectedPaths,
AccountsSeen,
HasRansomPrep,
RansomPrepCommandCount,
RansomPrepCommandSamples,
PrepAccounts,
EncryptionFirstSeen,
EncryptionLastSeen,
PrepFirstSeen,
PrepLastSeen,
ConfidenceScore
| extend timestamp = TimeGenerated,
HostCustomEntity = DeviceName
| order by ConfidenceScore desc, TimeGenerated desc
```
```kql
GambitPoliciesIssues
| where State == "Active" and Severity == "High"
```
## Escalation Criteria
- Inhibit System Recovery activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.
## False Positive Considerations
- Authorised backup software cleaning up old shadow copies — Backup agent process is signed, runs on a predictable schedule
- IT admin manual disk cleanup including shadows — Admin ran the command manually, confirmed via Live Response session
Generated by SOC Response Atlas by Basyrix.
Want to push this directly to Confluence? Upgrade to Basyrix Pro.
- /api/techniques/T1490.json
- /api/recommendations/T1490.json
- /api/d3fend/T1490.json
- /api/mappings/T1490.json
- /api/confluence/T1490.md
Example curl:
curl https://atlas.basyrix.com/api/recommendations/T1490.jsonResponse:
{
"technique_id": "T1490",
"name": "Inhibit System Recovery",
"priority": "high",
"status": "complete",
"version": "0.1.0",
"last_reviewed": "2026-07-23",
"generated_by": "SOC Response Atlas by Basyrix",
"tactics": [
"Impact"
],
"platforms": [
"Containers",
"ESXi",
"IaaS",
"Linux",
"macOS",
"Network Devices",
"Windows"
],
"summary": "Adversaries may delete or remove built-in data and turn off services designed to aid in the recovery of a corrupted system to prevent recovery. This may deny access to available backups and recovery options. Operating systems may contain features that can help fix corrupted systems, such as a backup catalog, volume shadow copies, and automatic repair features...",
"soc_recommendation": "Investigate Inhibit System Recovery activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
"d3fend_mappings": [
{
"id": "D3-SU",
"name": "Software Update",
"relationship": "harden",
"practical_action": "Apply Software Update to reduce this technique's viability before an incident occurs.",
"tooling": [
"Defender for Endpoint"
]
},
{
"id": "D3-RS",
"name": "Restore Software",
"relationship": "restore",
"practical_action": "Use Restore Software to recover affected systems or data after containment.",
"tooling": [
"Defender for Endpoint"
]
},
{
"id": "D3-SWI",
"name": "Software Inventory",
"relationship": "model",
"practical_action": "Use Software Inventory to establish a baseline that makes this technique's deviations easier to spot.",
"tooling": [
"Defender for Endpoint"
]
}
],
"investigation_steps": {
"microsoft": [
"Isolate the device immediately — do not wait for confirmation",
"Alert the entire SOC team — this is an all-hands event",
"Notify the SOC Manager by phone — who notifies the customer CISO",
"Activate IR-RANSOMWARE-01 playbook in the SOAR platform",
"Record the time of first alert — this is the start of the incident timeline",
"1 device: Isolated incident — still treat as active ransomware",
"2–5 devices: Active spread — consider emergency network segmentation at the switch level",
"5+ devices: Outbreak — activate BCP immediately, contact customer operations team"
],
"generic": [
"Confirm whether the observed inhibit system recovery activity matches expected administrative or application behaviour.",
"Identify the host, account, or resource where the activity occurred and its business criticality.",
"Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
"Real detection reference: \"Recovery Controls Disabled Without Encryption\" -- Standalone high-signal recovery sabotage rule. IM-002 covers ransomware encryption plus recovery inhibition; this rule catches the earlier stage where backups, shadow copies, or recovery controls are disabled before encryption."
]
},
"evidence_to_collect": [
"Host or resource affected",
"Account or identity involved",
"Timestamp of the activity",
"Related process, file, or network artifact",
"Any preceding or follow-on alerts"
],
"response_actions": [
{
"name": "Isolate ALL affected hosts",
"category": "Containment",
"risk": "Medium",
"automation_safe": false,
"approval_required": true,
"tool": "Defender for Endpoint",
"notes": "MDE portal (bulk isolation possible via Device groups)"
},
{
"name": "Disconnect NAS and network shares",
"category": "Containment",
"risk": "Low",
"automation_safe": false,
"approval_required": true,
"tool": "See investigation guide",
"notes": "from the network — unplug if necessary"
},
{
"name": "Notify:",
"category": "Containment",
"risk": "Low",
"automation_safe": true,
"approval_required": false,
"tool": "See investigation guide",
"notes": "SOC Manager → Head of Security Services → Customer CISO (phone)"
},
{
"name": "Activate BCP",
"category": "Containment",
"risk": "Low",
"automation_safe": false,
"approval_required": true,
"tool": "See investigation guide",
"notes": "can the customer operate without affected systems?"
},
{
"name": "Do NOT reboot",
"category": "Containment",
"risk": "Low",
"automation_safe": false,
"approval_required": true,
"tool": "See investigation guide",
"notes": "affected devices — preserve memory for forensic analysis"
},
{
"name": "Do NOT pay the ransom",
"category": "Containment",
"risk": "Low",
"automation_safe": false,
"approval_required": true,
"tool": "See investigation guide",
"notes": "advise the customer firmly against payment"
},
{
"name": "Confirm backup integrity — are backups clean and accessible?",
"category": "Eradication",
"risk": "Low",
"automation_safe": true,
"approval_required": false,
"tool": "See investigation guide"
},
{
"name": "Identify patient zero and begin root cause analysis",
"category": "Eradication",
"risk": "Low",
"automation_safe": false,
"approval_required": true,
"tool": "See investigation guide"
}
],
"queries": {
"kql": [
{
"name": "GEN-IM-004 — Recovery Controls Disabled Without Encryption",
"description": "Standalone high-signal recovery sabotage rule. IM-002 covers ransomware encryption plus recovery inhibition; this rule catches the earlier stage where backups, shadow copies, or recovery controls are disabled before encryption. (Source: Bell Integration baseline detection library.)",
"query": "let lookback = 1h;\nlet recoveryInhibitCommands = dynamic([\n \"vssadmin delete shadows\",\n \"vssadmin.exe delete shadows\",\n \"wmic shadowcopy delete\",\n \"wbadmin delete catalog\",\n \"wbadmin delete systemstatebackup\",\n \"get-wmiobject win32_shadowcopy\",\n \"get-ciminstance win32_shadowcopy\",\n \"bcdedit /set\",\n \"recoveryenabled no\",\n \"bootstatuspolicy ignoreallfailures\",\n \"schtasks.exe /change /tn \\\"\\\\microsoft\\\\windows\\\\systemrestore\\\\sr\\\" /disable\",\n \"reg add \\\"hklm\\\\software\\\\policies\\\\microsoft\\\\windows nt\\\\systemrestore\\\"\",\n \"disablesr\"\n]);\nDeviceProcessEvents\n| where TimeGenerated >= ago(lookback)\n| extend CommandLine = tolower(tostring(ProcessCommandLine))\n| where CommandLine has_any (recoveryInhibitCommands)\n| summarize\n FirstSeen = min(TimeGenerated),\n LastSeen = max(TimeGenerated),\n CommandCount = dcount(CommandLine),\n CommandSamples = make_set(ProcessCommandLine, 20),\n Accounts = make_set(AccountName, 10),\n ParentProcesses = make_set(InitiatingProcessFileName, 10)\n by DeviceId, DeviceName\n| project TimeGenerated = LastSeen, FirstSeen, LastSeen, DeviceId, DeviceName, CommandCount, CommandSamples, Accounts, ParentProcesses\n| extend timestamp = TimeGenerated,\n HostCustomEntity = DeviceName\n| order by TimeGenerated desc"
},
{
"name": "GEN-IM-002 — Data Encrypted for Impact - Ransomware",
"description": "Detects ransomware-style mass encryption and folds in the recovery-inhibition command coverage previously duplicated in IM-004. (Source: Bell Integration baseline detection library.)",
"query": "let detectionWindow = 1d;\nlet minEncryptedFiles = 20;\nlet suspiciousExtensions = dynamic([\n \"lockbit\", \"locked\", \"crypt\", \"crypto\", \"enc\", \"encrypted\", \"ryuk\", \"conti\", \"hive\", \"clop\", \"blackcat\", \"akira\"\n]);\nlet recoveryInhibitCommands = dynamic([\n \"vssadmin delete shadows\",\n \"vssadmin.exe delete shadows\",\n \"wmic shadowcopy delete\",\n \"wbadmin delete catalog\",\n \"wbadmin delete systemstatebackup\",\n \"get-wmiobject win32_shadowcopy\",\n \"get-ciminstance win32_shadowcopy\",\n \"bcdedit /set\",\n \"recoveryenabled no\",\n \"bootstatuspolicy ignoreallfailures\",\n \"schtasks.exe /change /tn \\\"\\\\microsoft\\\\windows\\\\systemrestore\\\\sr\\\" /disable\",\n \"reg add \\\"hklm\\\\software\\\\policies\\\\microsoft\\\\windows nt\\\\systemrestore\\\"\",\n \"disablesr\",\n \"wevtutil cl\",\n \"fsutil usn deletejournal\",\n \"cipher /w\"\n]);\nlet RansomPrepCommands =\n DeviceProcessEvents\n | where TimeGenerated >= ago(detectionWindow)\n | extend CommandLine = tolower(tostring(ProcessCommandLine))\n | where CommandLine has_any (recoveryInhibitCommands)\n | summarize\n RansomPrepCommandCount = dcount(CommandLine),\n RansomPrepCommandSamples = make_set(ProcessCommandLine, 20),\n PrepFirstSeen = min(TimeGenerated),\n PrepLastSeen = max(TimeGenerated),\n PrepAccounts = make_set(AccountName, 10)\n by DeviceId, DeviceName;\nlet MassEncryptionBehavior =\n DeviceFileEvents\n | where TimeGenerated >= ago(detectionWindow)\n | where ActionType in~ (\"FileCreated\", \"FileRenamed\", \"FileModified\")\n | extend FileExtension = tolower(tostring(split(FileName, \".\")[-1]))\n | where FileExtension in (suspiciousExtensions)\n | summarize\n EncryptedFileCount = count(),\n SampleEncryptedFiles = make_set(FileName, 20),\n AffectedPaths = make_set(FolderPath, 20),\n EncryptionFirstSeen = min(TimeGenerated),\n EncryptionLastSeen = max(TimeGenerated),\n AccountsSeen = make_set(InitiatingProcessAccountName, 10)\n by DeviceId, DeviceName\n | where EncryptedFileCount >= minEncryptedFiles;\nMassEncryptionBehavior\n| join kind=fullouter RansomPrepCommands on DeviceId, DeviceName\n| extend HasMassEncryption = coalesce(EncryptedFileCount, 0) >= minEncryptedFiles,\n HasRansomPrep = coalesce(RansomPrepCommandCount, 0) > 0\n| extend ConfidenceScore = iif(HasMassEncryption, iif(EncryptedFileCount >= 50, 2, 1), 0) + iif(HasRansomPrep, 2, 0)\n| where ConfidenceScore >= 2\n| project\n TimeGenerated = coalesce(EncryptionLastSeen, PrepLastSeen),\n DeviceId,\n DeviceName,\n HasMassEncryption,\n EncryptedFileCount,\n SampleEncryptedFiles,\n AffectedPaths,\n AccountsSeen,\n HasRansomPrep,\n RansomPrepCommandCount,\n RansomPrepCommandSamples,\n PrepAccounts,\n EncryptionFirstSeen,\n EncryptionLastSeen,\n PrepFirstSeen,\n PrepLastSeen,\n ConfidenceScore\n| extend timestamp = TimeGenerated,\n HostCustomEntity = DeviceName\n| order by ConfidenceScore desc, TimeGenerated desc"
},
{
"name": "8d2b6f4c-1a37-4e9b-b5c8-7f0e3a2d9c14 — Gambit Security - Critical Policy Issue Promotion",
"description": "Creates an incident when Gambit Security reports an Active, High-severity policy issue in Microsoft Sentinel.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
"query": "GambitPoliciesIssues\n| where State == \"Active\" and Severity == \"High\""
}
],
"spl": [],
"esql": [
{
"name": "1a3f2a4c-12d0-4b88-961a-2711ee295637 — Potential System Tampering via File Modification",
"description": "(EQL) Identifies attempts to delete or modify critical files used during the boot process to prevent the system from booting. This may indicate a destructive attack behavior. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
"query": "file where host.os.type == \"windows\" and event.type in (\"change\", \"deletion\") and\n file.name : (\"winload.exe\", \"winload.efi\", \"ntoskrnl.exe\", \"bootmgr\") and\n file.path : (\"?:\\\\Windows\\\\*\", \"\\\\Device\\\\HarddiskVolume*\\\\Windows\\\\*\") and\n not process.executable : (\n \"?:\\\\Windows\\\\System32\\\\poqexec.exe\",\n \"?:\\\\Windows\\\\System32\\\\wbengine.exe\",\n \"?:\\\\Windows\\\\WinSxS\\\\???64_microsoft-windows-servicingstack_*\\\\tiworker.exe\"\n ) and\n not file.path : (\n \"?:\\\\Windows\\\\WinSxS\\\\Temp\\\\InFlight\\\\*\",\n \"?:\\\\Windows\\\\SoftwareDistribution\\\\Download*\",\n \"?:\\\\Windows\\\\WinSxS\\\\amd64_microsoft-windows*\",\n \"?:\\\\Windows\\\\SystemTemp\\\\*\",\n \"?:\\\\Windows\\\\Temp\\\\????????.???\\\\*\",\n \"?:\\\\Windows\\\\Temp\\\\*\\\\amd64_microsoft-windows-*\",\n \"\\\\Device\\\\HarddiskVolume*\\\\Windows\\\\SoftwareDistribution\\\\Download*\",\n \"?:\\\\Windows\\\\Temp\\\\BootImages\\\\{*}\\\\mount\\\\Windows\\\\*\"\n )"
},
{
"name": "78e9b5d5-7c07-40a7-a591-3dbbf464c386 — Suspicious File Renamed via SMB",
"description": "(EQL) Identifies suspicious file rename operation by the virtual System process. This may indicate a remote ransomware attack via the SMB protocol. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
"query": "sequence by host.id, file.extension with maxspan=1s\n [file where host.os.type == \"windows\" and\n event.action == \"rename\" and process.pid == 4 and user.id : (\"S-1-5-21*\", \"S-1-12-*\") and\n file.extension != null and file.Ext.entropy >= 6 and file.path : \"C:\\\\Users\\\\*\" and\n file.Ext.original.name : (\"*.jpg\", \"*.bmp\", \"*.png\", \"*.pdf\", \"*.doc\", \"*.docx\", \"*.xls\", \"*.xlsx\", \"*.ppt\", \"*.pptx\", \"*.lnk\") and\n not file.extension : (\"jpg\", \"bmp\", \"png\", \"pdf\", \"doc\", \"docx\", \"xls\", \"xlsx\", \"ppt\", \"pptx\", \"lnk\")] with runs=3"
}
]
},
"automation": {
"safe": [
"Add recommendation as Sentinel incident comment.",
"Run enrichment queries.",
"Create ServiceNow SecOps task."
],
"approval_required": [
"Contain or disable the affected host/account.",
"Any change to production configuration."
]
},
"escalation_criteria": [
"Inhibit System Recovery activity observed on a privileged account or critical system.",
"Activity follows or precedes other suspicious behaviour in the same investigation.",
"Automated triage cannot confidently rule out malicious intent."
],
"false_positive_considerations": [
"Authorised backup software cleaning up old shadow copies — Backup agent process is signed, runs on a predictable schedule",
"IT admin manual disk cleanup including shadows — Admin ran the command manually, confirmed via Live Response session"
],
"confluence": {
"title": "T1490 - Inhibit System Recovery Response Guidance",
"labels": [
"mitre",
"attack",
"d3fend",
"secops",
"basyrix"
],
"sections": [
"summary",
"d3fend_mappings",
"investigation_steps",
"response_actions",
"queries",
"automation",
"escalation_criteria",
"false_positive_considerations"
]
}
}